Seven arrested for AI-assisted theft of 8.2M records in South Korea
Seoul police bust AI-assisted data theft ring
The Cyber Investigation Division of the Seoul Metropolitan Police Agency arrested seven people on October 26, 2026, in connection with a coordinated campaign to infiltrate corporate networks using generative AI tools FN News. The alleged ringleader, a 32-year-old man, was referred to prosecutors in custody on October 23, 2026, while six alleged accomplices were investigated without detention.
Between September 2025 and October 2026, the group targeted approximately 90 South Korean companies and organizations—including hospitals, golf courses, universities, private academies, and corporate affiliates—stealing more than 8.2 million personal information records and internal documents Asia Economy. Police said the suspects used generative AI alongside other tools to compromise security systems and access sensitive data.
Extortion threats and limited payoff
After gaining access, the group allegedly threatened 38 companies with data leaks, demanding a combined 360 million South Korean won, approximately $272,000 Korea JoongAng Daily. According to reports, the suspects used the threat: "If you don't pay, we'll leak the information." However, only 300,000 won was actually collected before police moved in.
Charges and legal framework
The alleged ringleader and accomplices face charges under South Korea's Act on Promotion of Information and Communications Network Utilization and Information Protection, as well as violations related to extortion and attempted extortion Law360. The case marks one of the first high-profile arrests in South Korea involving generative AI as a primary tool for large-scale corporate network compromise.
Significance for AI security
The incident demonstrates how commercially available generative AI tools can be weaponized for sophisticated cyberattacks when combined with social engineering and network reconnaissance techniques. The scale—90 targets and 8.2 million records stolen—underscores emerging vulnerabilities in enterprise security posture as attackers gain access to more capable automation tools.